Joseph Doherty
cf715b813b
Switch the three literal ${SCADABRIDGE_*} placeholders in appsettings.Central.json
to ${secret:} references resolved by the pre-host secrets expander, and update the
_secrets doc note. Fix Host.Tests fixtures that boot the real Program pipeline against
Central config: CentralDbTestEnvironment now also supplies the LDAP service-account
password and JWT signing key as whole-key env overrides (rollback path) so the expander
skips the tokens without a seeded store; the three fixtures that managed env vars
inline now use CentralDbTestEnvironment.
94 lines
5.0 KiB
C#
94 lines
5.0 KiB
C#
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
|
|
|
|
/// <summary>
|
|
/// Host-003: <c>appsettings.Central.json</c> no longer commits database connection
|
|
/// strings — they are externalised to environment variables. Tests that exercise the
|
|
/// full <c>Program</c> startup pipeline against the real SQL provider must therefore
|
|
/// supply the local dev connection string the way a deployment would: via an
|
|
/// environment variable (<c>Program</c>'s configuration builder calls
|
|
/// <c>AddEnvironmentVariables()</c>).
|
|
///
|
|
/// Also supplies <c>ScadaBridge__InboundApi__ApiKeyPepper</c> so the Central-role
|
|
/// StartupValidator preflight (added in 1fcc4f5) does not fail for tests that set
|
|
/// <c>DOTNET_ENVIRONMENT=Central</c> without an explicit pepper env var.
|
|
///
|
|
/// Also supplies <c>ScadaBridge__Database__MachineDataDb</c> so the Central-role
|
|
/// StartupValidator preflight (reverts Host-008, REQ-HOST-3/4, M2.9 #17) does not
|
|
/// fail for tests that set <c>DOTNET_ENVIRONMENT=Central</c> without an explicit
|
|
/// MachineDataDb env var.
|
|
///
|
|
/// G-4 (secrets adoption): <c>appsettings.Central.json</c> now carries
|
|
/// <c>${secret:...}</c> references for the ConfigurationDb connection string, the
|
|
/// LDAP service-account password and the JWT signing key. The pre-host secrets
|
|
/// expander (Program.cs) resolves those before StartupValidator runs and fails
|
|
/// closed on an unseeded reference. Supplying the concrete values as whole-key
|
|
/// environment overrides (the sanctioned rollback path) makes the expander skip
|
|
/// the tokens entirely — so tests that boot the real <c>Program</c> pipeline do
|
|
/// not need a seeded secrets store. All vars are restored on Dispose so tests
|
|
/// stay isolated.
|
|
/// </summary>
|
|
internal sealed class CentralDbTestEnvironment : IDisposable
|
|
{
|
|
// Local dev/test database — same credentials the infra docker-compose stack uses.
|
|
// This is a test fixture value, not a committed production secret.
|
|
private const string ConfigurationDb =
|
|
"Server=localhost,1433;Database=ScadaBridgeConfig;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true";
|
|
|
|
private const string ConfigKey = "ScadaBridge__Database__ConfigurationDb";
|
|
|
|
private const string MachineDataDb =
|
|
"Server=localhost,1433;Database=ScadaBridgeMachineData;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true";
|
|
|
|
private const string MachineDataKey = "ScadaBridge__Database__MachineDataDb";
|
|
|
|
// Test-only pepper — satisfies the ≥16-char StartupValidator requirement without
|
|
// committing a real secret. The env-var name uses the double-underscore delimiter
|
|
// so AddEnvironmentVariables() maps it to ScadaBridge:InboundApi:ApiKeyPepper.
|
|
internal const string TestPepper = "test-pepper-01234567890";
|
|
private const string PepperKey = "ScadaBridge__InboundApi__ApiKeyPepper";
|
|
|
|
// G-4: whole-key overrides for the two remaining ${secret:...} config references
|
|
// in appsettings.Central.json (the LDAP service-account password and JWT signing
|
|
// key). Test-only placeholder values — non-empty, and the JWT key clears the
|
|
// ≥32-char StartupValidator length rule. Applied via env so the pre-host expander
|
|
// sees the concrete value and never evaluates the token.
|
|
private const string LdapServiceAccountPassword = "test-ldap-service-account-password";
|
|
private const string LdapPasswordKey = "ScadaBridge__Security__Ldap__ServiceAccountPassword";
|
|
|
|
private const string JwtSigningKey = "test-signing-key-must-be-at-least-32-chars-long!";
|
|
private const string JwtSigningKeyKey = "ScadaBridge__Security__JwtSigningKey";
|
|
|
|
private readonly string? _previousConfig;
|
|
private readonly string? _previousMachineData;
|
|
private readonly string? _previousPepper;
|
|
private readonly string? _previousLdapPassword;
|
|
private readonly string? _previousJwtSigningKey;
|
|
|
|
public CentralDbTestEnvironment()
|
|
{
|
|
_previousConfig = Environment.GetEnvironmentVariable(ConfigKey);
|
|
Environment.SetEnvironmentVariable(ConfigKey, ConfigurationDb);
|
|
|
|
_previousMachineData = Environment.GetEnvironmentVariable(MachineDataKey);
|
|
Environment.SetEnvironmentVariable(MachineDataKey, MachineDataDb);
|
|
|
|
_previousPepper = Environment.GetEnvironmentVariable(PepperKey);
|
|
Environment.SetEnvironmentVariable(PepperKey, TestPepper);
|
|
|
|
_previousLdapPassword = Environment.GetEnvironmentVariable(LdapPasswordKey);
|
|
Environment.SetEnvironmentVariable(LdapPasswordKey, LdapServiceAccountPassword);
|
|
|
|
_previousJwtSigningKey = Environment.GetEnvironmentVariable(JwtSigningKeyKey);
|
|
Environment.SetEnvironmentVariable(JwtSigningKeyKey, JwtSigningKey);
|
|
}
|
|
|
|
public void Dispose()
|
|
{
|
|
Environment.SetEnvironmentVariable(ConfigKey, _previousConfig);
|
|
Environment.SetEnvironmentVariable(MachineDataKey, _previousMachineData);
|
|
Environment.SetEnvironmentVariable(PepperKey, _previousPepper);
|
|
Environment.SetEnvironmentVariable(LdapPasswordKey, _previousLdapPassword);
|
|
Environment.SetEnvironmentVariable(JwtSigningKeyKey, _previousJwtSigningKey);
|
|
}
|
|
}
|